Opportunities › Self-hosted dark web threat intelligence › Proposed app
Lowlight
Self-hosted dark web monitoring that turns queries into threat briefs
- Score
- 31
- confidence 45
- Evidence
- 5
- items on the page
- Rivals
- 3
- named in sources
- First version
- 60 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2009
- Mature market · AI estimate
ScreensConcept
Desktop app: Security analysts spend long sessions reading briefs, reviewing evidence, managing watchlists and configuring sources—dense information work requiring a large screen. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Today
Last sweep 12 min ago14 new
About this appAI proposal
Lowlight is a threat intelligence workspace you run on your own infrastructure. You describe what to watch: your domains, brands, executive names, leaked credential patterns or software. It collects from the underground sources you configure, scores what it finds and writes a short brief an analyst can act on.
It is built for security teams and OSINT analysts who need dark web visibility but cannot send their watchlists to a third-party SaaS, or cannot justify the cost of commercial platforms. Your watchlist, findings and notes stay inside your network.
Unlike a pile of scraping scripts, Lowlight goes from query to finished intelligence: collection, deduplication, triage, evidence snapshots and export to the tools your team already uses.
- Tagline
- See the underground by your own light, on your own servers.
- Voice
- CalmPreciseDiscreet
- Why this name
- Low light is where dark web work happens; the name suggests seeing clearly with a small, controlled light you own.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Watchlists that stay private
Keep domains, brand terms and people on your own servers. Nothing about what you monitor leaves your network.
No member yet
Query to brief
Each hit is summarised with source, context and a suggested next step, so analysts read briefs instead of raw posts.
No member yet
Source connectors
Add forums, marketplaces, paste sites and channels as connectors, each with its own schedule, rate limit and proxy setting.
No member yet
Evidence snapshots
Every finding keeps a timestamped, hash-sealed copy of the page so it survives takedowns and can be cited in a report.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#0F1A1CDeep Slate · surface#E8F1EEPale Mist · text#F2A93BLamp Amber · primary#3FB8A5Tide Teal · accent#E5604DSignal Red · alert, data#8FA5A3Fog Grey · muted text
Typography
Aa
Lowlight
PricingAI proposal
The material gives no competitor prices, only that commercial platforms are expensive. These tiers are a starting point to test, not derived from any competitor's pricing.
Community
Free
- Self-hosted, single user
- 3 source connectors
- Watchlists and triage board
- Community support
Team
$400 a month
- Up to 10 analysts
- Unlimited connectors
- Evidence snapshots and briefs
- SIEM, webhook and ticket exports
- Email support
Enterprise
Contact us
- SSO and audit logs
- Custom connectors
- Air-gapped install help
- Dedicated support
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- No loop in the product. Lowlight runs inside a security team's own network, so use produces little outward exposure. Briefs shared internally may name it, but customers come from content, community and direct sales.
- Do they become customers?
- Test whether open-source and security-community readers become paying Team customers. Exposure inside a customer's own company brings no new customer by itself.
- First customers
- Security teams of 3 to 15 people at mid-market companies in finance or healthcare, where data-handling rules make SaaS dark web monitoring hard to approve.
- Where to reach them
- GitHub and OSINT communities: Publish the free Community edition and sample connectors where self-hosted threat intelligence interest is already visible.
- Security practitioner forums: Share write-ups of query-to-brief workflows in analyst Slack groups and meetups.
- Direct outreach: Contact security leads at regulated mid-market firms with a pilot offer.
- First milestone
- Five paying Team customers in one regulated vertical within 90 days of the first release.
Why people already pay for this
- VerifiedGitHub repository gained 784 stars in 163 days
- Public claimCommercial threat intelligence platforms for dark web monitoring are expensive and limit access
- Public claimThere is demand for automated threat intelligence processing from query to actionable intelligence
- Public claimOrganizations prefer self-hosted solutions for security-sensitive threat intelligence
- Verified
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Collection workersContainerised crawlers with Tor/proxy supportDark web sources need anonymised, rate-limited collection that Vercel functions cannot run.
- This app · Self-hosted packagingDocker Compose and Helm chartCustomers run it on their own infrastructure, so the app must install outside Vercel.
RisksAI inference
- RegulatoryCollecting from criminal marketplaces may raise legal questions about stored illegal content, such as stolen data or abuse material. Needs filtering, retention rules and legal review per region.
- TechnicalUnderground sources use logins, captchas and anti-bot measures and change often. Connector upkeep may be the main ongoing cost.
- CommercialBuyers may value the data coverage of commercial providers more than software. A self-hosted tool without data may not be enough.
- AISummaries can misread slang or invent links between findings; analysts must see the source text beside every claim.
- CommercialOpen-source alternatives are free, and the GitHub interest may come from hobbyists who will not pay. Paying demand needs testing.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.